Design/Logic Flaw

Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite component: Reports Configuration. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

Buffer overflow

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite component: iSurvey Module. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful...

Design/Logic Flaw

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: MS Excel Specific. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

CVE-2023-22042

CVE-2023-22042 affects Oracle E-Business Suite, specifically the Diagnostics component of Oracle Applications Framework. Affected versions are 12.2.3–12.3.12. The issue allows an unauthenticated attacker with network access via HTTP to compromise the framework, with human interaction required, po...

CVE-2023-22037

The CVE-2023-22037 vulnerability affects Oracle E-Business Suite’s Oracle Web Applications Desktop Integrator (MS Excel Specific) with affected versions 12.2.3–12.2.12. The issue enables a low-privilege, network-accessible attacker (via HTTP) to compromise the component, requiring user interactio...

CVE-2023-22035

CVE-2023-22035 affects Oracle E-Business Suite, specifically the iSurvey Module (Oracle Scripting). Affected versions are 12.2.3 through 12.2.12. The issue allows an unauthenticated, network-accessible attacker over HTTP to compromise Oracle Scripting, with user interaction required, leading to p...

CVE-2023-22009

The CVE-2023-22009 issue affects Oracle E-Business Suite, specifically the Workforce Management component in Oracle Self-Service Human Resources. Affected versions are 12.2.3–12.2.12. The root cause is insufficient input validation in Workforce Management, enabling a low-privileged, network-acces...

CVE-2023-22004

CVE-2023-22004 affects Oracle E-Business Suite, specifically the Reports Configuration component of Oracle Applications Technology. Affected versions are 12.2.3–12.2.12. The flaw allows an unauthenticated attacker with network access via HTTP to compromise Oracle Applications Technology; exploita...

Pakistani Entities Targeted in Sophisticated Attack Deploying ShadowPad Malware

An unidentified threat actor compromised an application used by multiple entities in Pakistan to deliver ShadowPad, a successor to the PlugX backdoor that's commonly associated with Chinese hacking crews. Targets included a Pakistan government entity, a public sector bank, and a telecommunication...

FIN8 Group Using Modified Sardonic Backdoor for BlackCat Ransomware Attacks

The financially motivated threat actor known as FIN8 has been observed using a "revamped" version of a backdoor called Sardonic to deliver the BlackCat ransomware. According to the Symantec Threat Hunter Team, part of Broadcom, the development is an attempt on the part of the e-crime group to...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, and other functions. A security vulnerability in the Oracle Web...

PT-2023-3626 · Oracle · Oracle E-Business Suite

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the Workforce Management component of Oracle E-Business Suite, allowing a remote attacker to gain unauthorized acces...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, and other functions. A security vulnerability exists in the Oracle...

PT-2023-3705 · Oracle · Oracle E-Business Suite

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the Reports Configuration component of Oracle Applications Technology in Oracle E-Business Suite. This can be...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, and other functions. A security vulnerability exists in the Oracle...

Qubely < 1.8.6 - Unauthenticated Arbitrary E-mail Sending

Description The plugin allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubelysendformdata AJAX action. PoC Execute the below command in the web developer console, on the blog homepage as an unauthenticated user, replacing domain by the domain of the blog:...

e-rph.net Cross Site Scripting vulnerability OBB-3519548

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

e-msi.eu Cross Site Scripting vulnerability OBB-3518811

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

e-dimakis.gr Cross Site Scripting vulnerability OBB-3518541

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

e-government.hannover-stadt.de Cross Site Scripting vulnerability OBB-3517702

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...